The Cybersecurity and AI Board of Investigations Act of 2026 is a 35-page bill introduced in the Senate on September 24, 2026 by Sen. Edward J. Markey (D-Mass.). Congress.gov records it as S. 5541 of the 119th Congress, read twice and referred the same day to the Committee on Commerce, Science, and Transportation (Source: congress.gov). The text published by Markey's office is the Legislative Counsel draft (WAL26575 T7J) with the bill number and committee left blank. It has three sections: a short title, findings and purposes, and a single long section 3 that creates the Cybersecurity and AI Board of Investigations. The bill is described at Cybersecurity and AI Board of Investigations Act of 2026.
Findings and purposes (section 2)
Congress finds that cybersecurity infrastructure and institutions are integral to national and economic security; that cyber threats have become more pervasive and potentially more disruptive with digitization; that the advancement and accessibility of AI "can strengthen cybersecurity controls while also increasing the volume and sophistication of cyber threats"; that critical infrastructure sectors, "such as clean and wastewater utilities and telecommunications networks, are susceptible to artificial intelligence-enabled cyber incidents"; that these trends will accelerate as AI systems evolve; that quantum computing and other emerging technologies are likely to pose novel threats "that will compound on artificial intelligence-driven risks"; and that the federal government has an interest in understanding cyber incidents and advancing best practices. The purposes are to establish the board and to bolster the cyber defenses of public and private institutions against risks posed by AI and other emerging technologies.
Definitions (section 3(a))
- Artificial intelligence has the meaning in section 238(g) of the National Defense Authorization Act for Fiscal Year 2019 (Public Law 115–232).
- Cybersecurity purpose, cybersecurity threat, information system, security control and security vulnerability have the meanings in section 2200 of the Homeland Security Act of 2002 (6 U.S.C. 650).
- Federal agency covers any executive department, military department, government-controlled corporation or other executive-branch establishment, including the Executive Office of the President and independent regulatory agencies. Federal civilian executive branch agency excludes the Department of Defense and elements of the intelligence community; the corresponding information-system definition excludes national security systems and the systems described in 44 U.S.C. 3553(e)(2)–(3).
- Incident — an occurrence that actually or imminently jeopardizes, without lawful authority, the integrity, confidentiality or availability of information on an information system, or an information system.
- Near-miss — a circumstance in which a known or newly discovered security vulnerability is exploited in an attempt to jeopardize the integrity, confidentiality or availability of information on an information system, and "through which no harm amounting to a significant cyber incident, as defined by the Board, is realized."
- Relevant congressional committees — Senate Commerce, Science, and Transportation; Senate Homeland Security and Governmental Affairs; House Energy and Commerce; and House Homeland Security.
Establishment, purposes and structure (section 3(b))
The board is established as an independent establishment under 5 U.S.C. 104 on the date 90 days after enactment. It must publish a charter with non-exhaustive criteria for initiating reviews, conducting trend analyses, and limiting eligible incidents to those for which all evidence, findings and recommendations are unclassified or declassified to the board's knowledge at the time of selection.
Its purposes are to advance the safety, reliability and resilience of U.S. digital and communications infrastructure; to conduct "independent and impartial reviews and assessments" of (i) incidents affecting federal civilian or non-federal information systems, "particularly such systems that support critical infrastructure sectors," (ii) "near-misses in which a significant cybersecurity incident was narrowly averted," (iii) systemic vulnerabilities across sectors, vendors or technology categories, "including within the artificial intelligence sector," and (iv) breakdowns in regulatory oversight, coordination or response; to identify contributing technical, organizational and systemic failures and produce actionable recommendations; to maintain, with the Director of the National Institute of Standards and Technology and the Assistant Secretary of Commerce for Communications and Information, a system collecting confidential reports of incidents and near-misses; to publish timely reports; to issue trend analyses "with attention paid to the novel and intensified risks relating to the continued development and adoption of artificial intelligence"; to keep a historical record of major incidents; and to "operate independently from regulatory review and enforcement actions without assigning legal fault or liability."
The board must establish at least three offices. The Office of Investigations investigates significant incidents, information-system failures, intrusions and near-misses and develops the factual record. The Office of Trend Analysis and Learning administers the near-miss reporting system, issues public trend reports, and analyses risks from emerging technologies including AI. The Office of Coordination is the principal liaison with federal agencies and with the private sector, with separate internal units for each "to ensure clear channels of communication and preserve the independence of investigative activities."
The voluntary, anonymized near-miss reporting system (section 3(b)(5)) allows individuals and organizations to report near-misses within critical infrastructure sectors confidentially, "including events that could have disrupted critical communications or commerce systems or exposed private data"; protects reporters' identities; is designed to identify systemic vulnerabilities across technologies, sectors and governance models; and supports "proactive risk management and learning without attribution of fault or liability."
Membership and operations (sections 3(c)–(d), (f)–(h))
The board has five members, appointed by the President with the advice and consent of the Senate on the basis of technical qualification, professional standing and demonstrated knowledge in cybersecurity or related fields; no more than three may be of the same party. Terms are five years, with holdover until a successor is appointed; the President may remove a member only for "inefficiency, neglect of duty, or malfeasance in office"; pay may not exceed level IV of the Executive Schedule. The President designates a chair and a vice chair, each with Senate consent and each for three years; the chair is chief executive and administrative officer, appoints and pays staff, and supervises expenditures. Each member may appoint staff for their own office, limited (other than the chair) to positions allocated by the chair plus one senior professional position paid no more than GS-15 step 10. The board meets at least four times a calendar year; three members form a quorum.
Permanent staff may include lead investigators, malware analysts, system engineers, legal counsel, digital forensic experts, and communications professionals and technical writers. The board may also enter agreements with federally funded research and development centers, appoint special government employees, and contract private-sector or academic experts as investigators. It is exempt from the Federal Advisory Committee Act and the Government in the Sunshine Act.
The chair must develop, with board approval, a public charter, bylaws and procedures, including criteria for defining a significant cybersecurity incident and selecting incidents, and may contract with federal agencies, including coordinating with the Secretary of Commerce, NIST and the Assistant Secretary for Communications and Information. The chair may adopt a party participation system under which affected organizations, including entities "operating or providing digital communications, technology products, or critical infrastructure services implicated" in a matter, provide factual input; parties may not draft findings, shape recommendations, or review a final report before publication. The chair must also implement a conflict-of-interest system.
Reviews and reports (section 3(e))
A review begins on a majority vote of all members, and the result of the vote is public; the chair may call a meeting at any time to initiate one. Each report must contain factual findings and actionable recommendations on cybersecurity practice, resilience, incident response and public-private coordination; a timeline; an analysis of contributing technical, organizational and systemic factors; a lessons-learned section identifying what helped or impeded the review and any gaps in authorities, tools or interagency coordination, with recommendations for the board's own operations; appendices with technical indicators of compromise and detailed methodology; and a plain-language executive summary for a non-technical audience. Reports use only unclassified or declassified information appropriate for public release, go to the relevant congressional committees, and are made public, consistent with protections for voluntarily provided information. Lessons learned inform the board's procedures and are shared across the federal cybersecurity community. A federal civilian agency to which a recommendation applies must respond in writing within 90 days, "even when the Federal civilian executive branch agency does not follow the recommended course of action," so that the board can track implementation.
Information gathering (section 3(i))
The chair or a designee may request documents and testimony from, and issue subpoenas ad testificandum and duces tecum to, any entity or individual affected by an incident under review, any responder, and anyone the board reasonably believes has relevant information. Anyone may provide information voluntarily, with or without a request; information supplied in response to a board request is treated as voluntarily provided.
If a response to a request is deficient, a subpoena may issue after approval by a simple majority of members, who must consider whether non-compulsory means or further communication could obtain the information, whether a reasonable time has elapsed, the importance of the information to a complete review, and whether, after consulting relevant agencies, the subpoena would affect a regulatory, law enforcement, foreign intelligence or diplomatic effort. Non-compliance may be referred to the Attorney General for a civil action in the district where the recipient resides, is found or does business, or in the District of Columbia, and punished as contempt. The subpoena power does not apply to federal, state, local, tribal or territorial government entities or their employees acting in their official duties; it may be delegated only to another board member; an electronically issued subpoena must carry a cryptographic digital signature or it is invalid; and the board is a "governmental entity" for preservation requests under 18 U.S.C. 2703(f). Subpoenaed material does not receive the voluntary-submission protections but may be withheld from public disclosure at the board's discretion. Nothing in the section permits or requires disclosure by communications providers beyond what the Stored Communications Act allows. Federal agency heads must furnish information the chair requests.
Protections for voluntarily provided information (sections 3(j)–(k))
Voluntarily provided documents and testimony may be disclosed to and used by the federal government only for a cybersecurity purpose; to identify a cybersecurity threat, its source, or a security vulnerability; to respond to a specific threat of death, serious bodily harm or serious economic harm, including terrorism or use of a weapon of mass destruction; to address a serious threat to a minor; or to prevent, investigate or prosecute an offense arising from an assessed incident or an offense listed in section 105(d)(5)(A)(v) of the Cybersecurity Act of 2015. Such material is treated as the provider's commercial, financial and proprietary information when so designated; is exempt from the Freedom of Information Act and from state, tribal and local open-records and sunshine laws; waives no privilege, including trade-secret protection; and is not subject to ex parte communication rules. No cause of action lies from the voluntary provision of documents, and a voluntary submission, or any record created solely to prepare it, may not be received in evidence, subject to discovery, or used in any proceeding, except to investigate or prosecute a person alleged to have committed, conspired in, or aided the incident described, provided the submission itself is not disclosed. Information developed from an independent source is not covered. All information provided to or obtained by the board must be handled to protect personal information and stored at least to the moderate-impact level of FIPS Publication 199.
Discrepancies noted
The draft's internal cross-references do not all resolve. Section 3(e)(1) says the board may initiate "a review and assessment described in subsection (b)(2)(B)," which is the charter provision on trend analyses; reviews and assessments are described in subsection (b)(3)(B), which section 3(e)(2)–(3) cite. Section 3(b)(3)(D) refers to "the near-miss system established under paragraph (4)," which establishes the board's offices; the near-miss system is established in paragraph (5), which section 3(b)(4)(B)(i) cites. The text contains no authorization of appropriations.
Relation to other instruments
The bill creates an investigative body rather than a reporting duty: it imposes no obligation on AI developers to notify anyone, and its findings carry no legal fault. That distinguishes it from the incident-reporting provisions of SB 53 and the RAISE Act, and from the 15-day critical safety incident reporting in the AI Regulator Act announced the previous day by Sens. Michael Bennet and Peter Welch (AI Regulator Act of 2026 — Section-by-Section Summary (Bennet and Welch)); the comparison is developed at AI Incident Reporting. Markey's office compares the board's subpoena authority to that of the National Transportation Safety Board and connects the bill to the July 2026 Hugging Face intrusion by OpenAI agents (Source: markey.senate.gov); see AI Agent Containment Incidents, 2026.
Provenance
Captured September 25, 2026 from the canonical Senate office host and extracted with pdftotext, with running headers, page numbers and line numbers removed. The bill number and committee referral were confirmed on congress.gov on September 26, 2026.
Relationships
- supports: Cybersecurity and AI Board of Investigations Act of 2026 — primary text
- instance-of: AI Incident Reporting
- related: Ed Markey
- related: National Institute of Standards and Technology (NIST) — coordinating agency for the near-miss system
- related: Cybersecurity and Infrastructure Security Agency (CISA) — regulator role
- related: AI Agent Containment Incidents, 2026
- related: AI Regulator Act of 2026 — Section-by-Section Summary (Bennet and Welch)